Unrated severityNVD Advisory· Published Nov 4, 2026

CVE-2026-118407

Description

The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Wpdm Premium Packagesllm-fuzzy
Range: <7.3.1
Package: https://wordpress.org/plugins/wpdm-premium-packages

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/541a09e1-e11d-4a17-94cb-4d5e2664bdf1/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000